Istio CA rotation

With Istio built in CA will we need to rotate root certificate at any point/will it expire?

the self-signed rootCA has a life time of 10 years and it’s auto-rotate. If you are using external rootCA, that is in your control and it’s recommended to rotate it frequently.